Aruba CX: basic VLAN and trunk configuration

The Aruba CX series switches offer a modern, AOS-CX based operating system that diverges significantly from the traditional ArubaOS-Switch (ProVision…

The Aruba CX series switches offer a modern, AOS-CX based operating system that diverges significantly from the traditional ArubaOS-Switch (ProVision ASIC) or Comware platforms. Understanding basic VLAN and trunk configurations is fundamental for network engineers migrating to or managing CX environments. This article details the steps for creating VLANs, assigning ports to VLANs (access mode), and configuring trunk links to carry multiple VLANs between switches or to hypervisors.

VLAN Creation and Management

VLANs (Virtual Local Area Networks) segment broadcast domains, enhance security, and improve network performance. On Aruba CX, VLANs are global configurations that are then applied to interfaces.

Creating a Single VLAN

To create a single VLAN, enter global configuration mode and use the vlan command. For example, to create VLAN 10 (named "Users") and VLAN 20 (named "Servers"):


switch# configure terminal
switch(config)# vlan 10
switch(config-vlan)# name Users
switch(config-vlan)# exit
switch(config)# vlan 20
switch(config-vlan)# name Servers
switch(config-vlan)# exit
switch(config)# show vlan 10
switch(config)# show vlan brief

The show vlan brief command provides a concise summary of all configured VLANs and their status.

Creating Multiple VLANs

You can create multiple VLANs in a single command, which is particularly useful during initial setup or bulk configurations.


switch(config)# vlan 30,40,50
switch(config-vlan)# exit
switch(config)# show vlan brief

Note that when using the comma-separated format, you cannot assign names directly within that command. You would need to enter each VLAN's configuration context individually to name them.

Access Port Configuration

An access port belongs to a single VLAN and carries untagged traffic for that VLAN. This is typically used for connecting end devices like workstations, IP phones, or printers.

To configure an interface as an access port, navigate to the interface context and assign it to a VLAN. VLAN 1 is the default untagged VLAN for all ports, so explicitly configuring an access VLAN will change this default.


switch(config)# interface 1/1/1
switch(config-if)# no shutdown
switch(config-if)# vlan access 10
switch(config-if)# description "User Workstation Port"
switch(config-if)# exit
switch(config)# interface 1/1/2
switch(config-if)# no shutdown
switch(config-if)# vlan access 20
switch(config-if)# description "Server NIC Port"
switch(config-if)# exit
switch(config)# show interface 1/1/1
switch(config)# show vlan 10

In the show interface output, look for the "VLAN Status" or "VLAN Tagging" section to confirm the access VLAN assignment. The show vlan [id] command will also list the member ports.

Trunk Port Configuration

Trunk ports carry traffic for multiple VLANs, typically between switches, to routers, or to hypervisors (e.g., VMware ESXi, KVM). On Aruba CX, trunk ports have a concept of a "native VLAN" (untagged VLAN) and "allowed VLANs" (tagged VLANs).

Basic Trunk with Native VLAN

The native VLAN is used for untagged traffic on a trunk port. It's often used for management VLANs or for devices that don't tag their traffic but need to communicate over a trunk. By default, VLAN 1 is the native VLAN on a trunk. It's good practice to explicitly define the native VLAN, even if it's VLAN 1, for clarity and security.


switch(config)# interface 1/1/24
switch(config-if)# no shutdown
switch(config-if)# vlan trunk native 1
switch(config-if)# vlan trunk allowed 10,20,30-35,40
switch(config-if)# description "Uplink to Core Switch - Tagged VLANs 10,20,30-35,40"
switch(config-if)# exit
switch(config)# show interface 1/1/24
switch(config)# show vlan trunk

The vlan trunk allowed command specifies which VLAN IDs are permitted to traverse the trunk link. VLANs not explicitly allowed will be dropped. The show vlan trunk command is very useful for verifying trunk configurations across all interfaces.

Trunk without a Native VLAN (Tagged-Only Trunk)

In some scenarios, especially when connecting to hypervisors or other network devices that strictly expect tagged traffic, you might want a trunk port to carry only tagged VLANs, with no native untagged VLAN. This is achieved by removing the native VLAN assignment.


switch(config)# interface 1/1/23
switch(config-if)# no shutdown
switch(config-if)# no vlan trunk native
switch(config-if)# vlan trunk allowed 50,60,70
switch(config-if)# description "Uplink to ESXi Host - All Tagged"
switch(config-if)# exit
switch(config)# show interface 1/1/23

When no vlan trunk native is configured, all traffic on that port will be expected to be tagged with an allowed VLAN ID. Any untagged traffic received on this port will be dropped.

Summary of VLAN Port Modes

Aruba CX uses a slightly different terminology for port modes compared to some other vendors. Here's a quick comparison:

Aruba CX Term	Common Equivalent (e.g., Cisco)	Description
`vlan access <VLAN_ID>`	`switchport mode access` `switchport access vlan <VLAN_ID>`	Port carries untagged traffic for a single VLAN. Connects to end devices.
`vlan trunk native <VLAN_ID>` `vlan trunk allowed <VLAN_IDs>`	`switchport mode trunk` `switchport trunk native vlan <VLAN_ID>` `switchport trunk allowed vlan <VLAN_IDs>`	Port carries untagged traffic for the native VLAN and tagged traffic for allowed VLANs. Connects switches/routers/hypervisors.
`no vlan trunk native` `vlan trunk allowed <VLAN_IDs>`	`switchport mode trunk` `switchport trunk native vlan none` (sometimes)	Port carries only tagged traffic for allowed VLANs. All untagged traffic is dropped.

Verifying VLAN and Trunk Configurations

After configuring VLANs and ports, it's crucial to verify that everything is set up correctly.

show vlan brief: Provides a quick overview of all VLANs and their members.
show vlan <VLAN_ID>: Detailed information for a specific VLAN, including its status and member interfaces.
show interface <INTERFACE_ID>: Displays comprehensive details about an interface, including its VLAN assignment and trunk status.
show vlan trunk: Lists all interfaces configured as trunks and their allowed/native VLANs.
show running-config interface <INTERFACE_ID>: Shows the running configuration snippet for a specific interface.
show running-config vlan <VLAN_ID>: Shows the running configuration snippet for a specific VLAN.

Common Pitfalls and Troubleshooting

VLAN Mismatch on Trunks: Ensure that the native VLAN is consistent on both ends of a trunk link, or explicitly configure no vlan trunk native on both sides if a tagged-only trunk is desired. Mismatched native VLANs can lead to unexpected connectivity issues for untagged traffic.
Allowed VLAN Mismatch: If VLANs are allowed on one end of a trunk but not the other, traffic for those specific VLANs will not pass. Always verify the vlan trunk allowed list on both sides.
Interface State: Always ensure the interface is not shut down (no shutdown). A port in a down state will not pass any traffic regardless of its VLAN configuration.
VLAN Existence: A VLAN must be created globally before it can be assigned to an interface (access or trunk allowed). If you try to assign an access VLAN or allow a trunk VLAN that doesn't exist, the command might fail or the VLAN might not function correctly.
Default VLAN 1: Remember that VLAN 1 is the default untagged VLAN for all ports. If you configure a port as vlan access 10, it automatically removes it from VLAN 1. For trunk ports, if no native VLAN is specified, VLAN 1 remains the default native VLAN unless explicitly removed with no vlan trunk native.
Tagged vs. Untagged: End devices typically send untagged traffic and should connect to access ports. Network devices (switches, routers) and hypervisors expect tagged traffic over trunk ports for multiple VLANs. Ensure the configuration matches the device's expectation.